# Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

**Stack:** Go

- Prevalence: Alta Frequentemente explorada
- Impact: Alto 3 regras de severidade alta
- Prevention: Documentada 3 exemplos de correção

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

Software has certain assumptions about what constitutes data and control. Injection problems occur when these assumptions are violated. Attackers exploit this by inserting special characters or instructions that modify the intended interpretation.

## Prevention

Estratégias de prevenção para Injection baseadas em 1 regras de detecção do Shoulder.

### Go

Use structured prompts with clear system/user boundaries and sanitize user input

## Warning Signs

- [HIGH] User input flows to ... without sanitization
- [HIGH] user input flowing to LLM prompts without sanitization

## Consequences

- Executar código não autorizado
- Ler dados da aplicação
- Modificar dados da aplicação
- Burlar mecanismo de proteção

## Mitigations

- Use interfaces parametrizadas que separem código de dados
- Valide e codifique toda a entrada antes de usá-la em componentes downstream
- Use allowlists para validação de entrada sempre que possível

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **AI Prompt Injection** [HIGH]: Detects user input flowing to LLM prompts without sanitization.
  - Remediation: Sanitize user input and use structured prompts with clear system/user boundaries.

```go
sanitized := sanitize(userInput)
messages := []openai.ChatCompletionMessage{
    {Role: "system", Content: systemPrompt},
    {Role: "user", Content: sanitized},
}
```

Learn more: https://shoulder.dev/learn/go/cwe-74/prompt-injection